feat: add E2E test helpers and update checklist for physical board testing

2 files changed, 88 insertions, 2 deletions

diff --git a/docs/TOLLGATE_CORE_DESIGN.md b/docs/TOLLGATE_CORE_DESIGN.md
index a1ec639..d5ed06f 100644
--- a/docs/TOLLGATE_CORE_DESIGN.md
+++ b/docs/TOLLGATE_CORE_DESIGN.md
@@ -327,7 +327,7 @@ This refactoring **must not proceed** until these branches land on master:
 - [x] Implement `tollgate_core_tick()` — session expiry check
 - [x] Implement `tollgate_core_get_status_json()` — JSON status
 - [x] Implement `tollgate_core_get_config_json()` — JSON config (via platform)
-- [ ] Build and verify standalone
+- [x] Build and verify standalone
 
 ### Phase 4: Standalone Platform Implementation
 
@@ -344,7 +344,26 @@ This refactoring **must not proceed** until these branches land on master:
 - [x] Remove old `main/cashu.c`, `main/dns_server.c`, `main/firewall.c`, `main/session.c` from CMakeLists.txt
 - [x] Update `main/CMakeLists.txt` (remove old SRCS, add `tollgate_platform.c`, add `tollgate_core` to REQUIRES)
 - [x] Update `main/lwip_tollgate_hooks.h` to call `tollgate_core_ip4_canforward_filter`
-- [ ] Full standalone build + test
+- [x] Full standalone build + test (verified: `c8c68dc` — build passes, 61/61 unit tests pass)
+
+### Phase 4.5: Physical Board E2E Testing (Board A)
+
+- [x] Create `tests/integration/helpers/network.mjs` (shared test utilities)
+- [x] Add arch test Makefile targets with mutex protection to `physical-router-test-automation/esp32/Makefile`
+- [x] Add top-level Makefile wrappers for arch tests
+- [ ] Acquire Board A mutex lock
+- [ ] Flash arch firmware to Board A
+- [ ] Verify boot via serial (no panics, services started)
+- [ ] Connect WiFi to Board A AP
+- [ ] Run smoke test (`arch-test-smoke`)
+- [ ] Run network test (`arch-test-network`)
+- [ ] Run API test (`arch-test-api`)
+- [ ] Run DNS + firewall test (`arch-test-dns-fw`)
+- [ ] Run reset auth test (`arch-test-reset`)
+- [ ] Run session expiry test (`arch-test-session`)
+- [ ] Run phase 2 API test (`arch-test-phase2`)
+- [ ] Commit and push test results
+- [ ] Release Board A mutex lock
 
 ### Phase 5: ESP-Miner Integration
 
diff --git a/tests/integration/helpers/network.mjs b/tests/integration/helpers/network.mjs
new file mode 100644
index 0000000..87bc5c5
--- /dev/null
+++ b/tests/integration/helpers/network.mjs
@@ -0,0 +1,67 @@
+import { execSync } from 'child_process';
+
+const DEFAULT_IP = '10.192.45.1';
+const WIFI_IFACE = 'wlp59s0';
+
+export function getPortalIP() {
+  return process.env.TOLLGATE_IP || DEFAULT_IP;
+}
+
+export function curl(url, timeout = 5) {
+  try {
+    return execSync(
+      `curl -s -o /dev/null -w "%{http_code}" --connect-timeout ${timeout} --max-time ${timeout + 5} "${url}"`,
+      { encoding: 'utf8', timeout: (timeout + 5) * 1000 }
+    ).trim();
+  } catch {
+    return null;
+  }
+}
+
+export function curlBody(url, timeout = 5) {
+  try {
+    return execSync(
+      `curl -s --connect-timeout ${timeout} --max-time ${timeout + 5} "${url}"`,
+      { encoding: 'utf8', timeout: (timeout + 5) * 1000 }
+    );
+  } catch {
+    return null;
+  }
+}
+
+export function canPing(host = '8.8.8.8', count = 1) {
+  try {
+    const result = execSync(
+      `ping -c ${count} -W 3 -I ${WIFI_IFACE} ${host} 2>/dev/null`,
+      { encoding: 'utf8', timeout: 10000 }
+    );
+    return result && !result.includes('100% packet loss');
+  } catch {
+    return false;
+  }
+}
+
+export function canResolve(domain, timeout = 3) {
+  try {
+    const result = execSync(
+      `nslookup -timeout=${timeout} ${domain} 2>&1`,
+      { encoding: 'utf8', timeout: (timeout + 2) * 1000 }
+    );
+    return result && result.includes('Address') && !result.includes('NXDOMAIN');
+  } catch {
+    return false;
+  }
+}
+
+export function dnsResolvesToSelf(domain) {
+  const ip = getPortalIP();
+  try {
+    const result = execSync(
+      `nslookup ${domain} ${ip} 2>&1`,
+      { encoding: 'utf8', timeout: 8000 }
+    );
+    return result && result.includes(ip);
+  } catch {
+    return false;
+  }
+}